CLSA-2026-1784559374
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1784559374.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1784559374
- Upstream
- Published
- 2026-07-20T14:56:45Z
- Modified
- 2026-10-26T09:32:05Z
- Summary
- Fix CVE(s): CVE-2026-42011, CVE-2026-42012, CVE-2026-42013
- Details
-
- SECURITY UPDATE: Name constraints bypass when prior CAs have only
excluded constraints
- debian/patches/CVE-2026-42011.patch: remove the empty-permitted early return in name_constraints_node_list_intersect in lib/x509/name_constraints.c so permitted name constraints of a subsequent CA still propagate when previous CAs only carried excluded constraints; also backport the upstream regression suites to tests/name-constraints-merge.c
- CVE-2026-42011
- SECURITY UPDATE: Certificate validation bypass via oversized subject
alternative name
- debian/patches/CVE-2026-42013.patch: refactor the CN and DN-email fallback logic and disable the fallback when gnutls_x509_crt_get_subject_alt_name reports an oversized SAN (GNUTLS_E_SHORT_MEMORY_BUFFER) in gnutls_x509_crt_check_hostname2 and gnutls_x509_crt_check_email (lib/x509/hostname-verify.c, lib/x509/email-verify.c); also backport the upstream regression tests to tests/hostname-check.c and tests/cert-tests/email (with tests/cert-tests/email-certs/oversized-san.pem)
- CVE-2026-42013
- SECURITY UPDATE: CN fallback not precluded by URI or SRV subject
alternative names
- debian/patches/CVE-2026-42012.patch: add GNUTLS_SAN_URI and GNUTLS_SAN_OTHERNAME_SRV to the PRECLUDES_CN_FALLBACK macro in lib/x509/hostname-verify.c so certificates presenting URI or SRV SANs no longer allow hostname matching against the common name per RFC 6125 6.4.4; backport SRV virtual-SAN awareness (lib/includes/gnutls/gnutls.h.in, lib/x509/common.h, lib/x509/virt-san.c, lib/x509/output.c, lib/x509/x509.c) and the get_alt_name othername virtualization fix so SRV othernames are recognized on 3.6.13; also backport the upstream regression tests to tests/hostname-check.c
- CVE-2026-42012
- SECURITY UPDATE: Name constraints bypass when prior CAs have only
excluded constraints
- References